ESET NOD32 Antivirus: Improper Handling of Exceptional Conditions
CVE-2022-27167 is a high-severity improper handling of exceptional conditions vulnerability in ESET NOD32 Antivirus from ESET, spol. s r.o., with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists version 15.1.12.0 as the first without the flaw, so updating ESET NOD32 Antivirus to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.19% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update ESET NOD32 Antivirus to 15.1.12.0 or a later version.
- Update ESET Internet Security to 15.1.12.0 or a later version.
- Update ESET Smart Security Premium to 15.1.12.0 or a later version.
- Read the advisory on support.eset.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| ESET, spol. s r.o. | ESET NOD32 Antivirus | 11.2 up to, but not including, 15.1.12.0 | 15.1.12.0 |
| ESET, spol. s r.o. | ESET Internet Security | 11.2 up to, but not including, 15.1.12.0 | 15.1.12.0 |
| ESET, spol. s r.o. | ESET Smart Security Premium | 11.2 up to, but not including, 15.1.12.0 | 15.1.12.0 |
| ESET, spol. s r.o. | ESET Endpoint Antivirus | 6.0 up to, but not including, 9.0.2046.0 | 9.0.2046.0 |
| ESET, spol. s r.o. | ESET Endpoint Security | 6.0 up to, but not including, 9.0.2046.0 | 9.0.2046.0 |
| ESET, spol. s r.o. | ESET Server Security for Microsoft Windows Server | 8.0 up to, but not including, 9.0.12012.0 | 9.0.12012.0 |
| ESET, spol. s r.o. | ESET File Security for Microsoft Windows Server | 6.0 8.0.12013.0 | Not stated |
| ESET, spol. s r.o. | ESET Mail Security for Microsoft Exchange Server | 6.0 up to, but not including, 8.0.10020.0 | 8.0.10020.0 |
| ESET, spol. s r.o. | ESET Mail Security for IBM Domino | 6.0 up to, but not including, 8.0.14011.0 | 8.0.14011.0 |
| ESET, spol. s r.o. | ESET Security for Microsoft SharePoint Server | 6.0 up to, but not including, 8.0.15009.0 | 8.0.15009.0 |
| Eset | Endpoint Antivirus | 6.0 up to, but not including, 8.0.2053.0; 8.1 up to, but not including, 8.1.2050.0; 9.0 up to, but not including, 9.0.2046.0 | 8.0.2053.0, 8.1.2050.0, 9.0.2046.0 |
| Eset | Endpoint Security | 6.0 up to, but not including, 8.0.2053.0; 8.1 up to, but not including, 8.1.2050.0; 9.0 up to, but not including, 9.0.2046.0 | 8.0.2053.0, 8.1.2050.0, 9.0.2046.0 |
| Eset | File Security | 6.0 up to, but not including, 8.0.12013.0 | 8.0.12013.0 |
| Eset | Internet Security | 11.2 up to, but not including, 15.1.12.0 | 15.1.12.0 |
| Eset | Mail Security | 6.0 up to, but not including, 8.0.10020.0; 6.0 up to, but not including, 8.0.14011.0 | 8.0.10020.0, 8.0.14011.0 |
| Eset | Nod32 Antivirus | 11.2 up to, but not including, 15.1.12.0 | 15.1.12.0 |
| Eset | Security | 6.0 up to, but not including, 8.0.15009.0 | 8.0.15009.0 |
| Eset | Server Security | 6.0 and later; 8.0 up to, but not including, 9.0.12012.0 | 9.0.12012.0 |
| Eset | Smart Security | 11.2 up to, but not including, 15.1.12.0 | 15.1.12.0 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.1 | High | CNA (eset.com) |
| CVSS 3.1 | 7.1 | High | NVD |
| CVSS 2.0 | 3.6 | Low | NVD |
Official description
Privilege escalation vulnerability in Windows products of ESET, spol. s r.o. allows attacker to exploit "Repair" and "Uninstall" features what may lead to arbitrary file deletion. This issue affects: ESET, spol. s r.o. ESET NOD32 Antivirus 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o. ESET Internet Security 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o. ESET Smart Security Premium 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o. ESET Endpoint Antivirus 6.0 versions prior to 9.0.2046.0. ESET, spol. s r.o. ESET Endpoint Security 6.0 versions prior to 9.0.2046.0. ESET, spol. s r.o. ESET Server Security for Microsoft Windows Server 8.0 versions prior to 9.0.12012.0. ESET, spol. s r.o. ESET File Security for Microsoft Windows Server 8.0.12013.0. ESET, spol. s r.o. ESET Mail Security for Microsoft Exchange Server 6.0 versions prior to 8.0.10020.0. ESET, spol. s r.o. ESET Mail Security for IBM Domino 6.0 versions prior to 8.0.14011.0. ESET, spol. s r.o. ESET Security for Microsoft SharePoint Server 6.0 versions prior to 8.0.15009.0.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
More Improper Handling of Exceptional Conditions vulnerabilities (CWE-755)
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Advisories
Other vulnerabilities in ESET NOD32 Antivirus
- 8.4 High severity
- 8.5 High severity
- 7.8 High severity
- 8.6 High severity
- 7.8 High severity
Recent Improper Handling of Exceptional Conditions vulnerabilities
- 8.4 High severity
- 7.8 High severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
Spotted an error? Tell us.